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In the Claims: 

1. (Original) A system comprising: 

a participant subsystem that is authorized to anonymously participate in a 
plurality of sessions using secret information provided by a manager subsystem; and 

a reception subsystem that determines whether it is acceptable for the 
participant subsystem to participate in a session, 

wherein 

the participant subsystem comprises: 

an anonymous signing section for authorizing individual data using the 
secret information depending on session-related information to produce anonymous 
participation data with anonymous signature, and 

the reception subsystem comprises: 

an anonymous signature determining section for determining whether 
received data is anonymous participation data with anonymous signature authorized by the 
participant subsystem; and 

a sender match determining section for determining whether 
anonymous signatures of arbitrary two pieces of anonymous participation data are signed by 
an identical participant subsystem. 



2. (Original) The system according to claim 1, wherein the anonymous 
signature includes data that is generated by a predetermined expression using the session- 
related information and the secret information, wherein the sender match determining section 
checks the data included in the anonymous signature of received anonymous participation 
data. 
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3. (Original) The system according to claim 2, wherein the predetermined 
expression is represented by raising a session-dependent base to a power that is dependent on 
the secret information. 

4. (Original) The system according to claim 1, wherein the anonymous 
signing section authorizes the individual data based on a group signature scheme. 

5. (Original) The system according to claim 1, wherein the anonymous 
signing section authorizes the individual data based on an escrowed identity scheme. 

6. (Original) The system according to claim 1, wherein the anonymous 
signing section comprises: 

a generator creating section for creating a session-dependent generator 
depending on the session-related information; 

a group signing section for signing the individual data using the 
session-dependent generator and the secret information to produce anonymous participation 
data, wherein the anonymous participation data includes data obtained by raising the session- 
dependent generator to a power determined by the secret information; and 

a linkage data generating section for generating linkage data indicating 
a relationship among the session-dependent generator and a generator determined by the 
individual data and/or the session-related information. 
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7. (Original) The system according to claim 6, wherein the secret 
information is represented by (x, y, v) that satisfies: v = (y + 8) 1/e mod w, where y = a x mod n, 
n is a product of two prime numbers as used in the RSA cryptography, g is a generator that 
generates a cyclic group of order «, a is an integer mutually prime to n, e is an integer 
mutually prime to the Euler number of n, and 8 is a constant other than 1, 

the generator creating section creates a session-dependent generator g A 
corresponding to a session A and a generator g m is generated based on the individual data m 
and/or the session A 9 

the group signing section sets z = g/ and generates a first proof 

statement 

V\ = SKLOGLOG(z,^^)[a:z = g A ( a ^](l) 
proving the knowledge of a satisfying z == gA^ a ^ and a second proof statement 

V 2 = SKROOTLOG(z*^ 5 5 ^, e )[p: z*g/ = ^(P0](1) 
proving the knowledge of p satisfying z*g A d = gA^X 

the linkage data generating section sets z\ = g m y 9 and generates a third 

proof statement 

V 3 = SKREP(z,/z, g m /g A )[y: z x lz =(g m /g A ) y ](l) 

proving the knowledge of z\ and z have the same power to the bases g m and g A , 
respectively, 

wherein the anonymous participation data is defined as (A, m, z, z\, V\, 

V 2 , V 3 ). 

8. (Original) The system according to claim 7, wherein 
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the anonymous signature determining section checks V\ 9 V2, and V3 of 
the anonymous participation data to determine whether received data is anonymous 
participation data with anonymous signature authorized by the participant subsystem, and 

the sender match determining section checks z of the anonymous 
participation data to determine whether anonymous signatures of arbitrary two pieces of 
anonymous participation data are signed by an identical participant subsystem. 



9. (Original) The system according to claim 1, wherein the anonymous 
signing section comprises: 

a generator creating section for creating a generator depending on the 
session-related information; 

a group signing section for signing the individual data using the 
generator and the secret information to produce anonymous participation data, wherein the 
anonymous participation data includes data obtained by raising the session-dependent 
generator to a power determined by the secret information. 



10. (Original) The system according to claim 9, wherein the secret 
information is represented by (x, y, v) that satisfies: v = (y + 5) 1/e mod n, where y = a x mod n, 
the individual data is denoted by m, n is a product of two prime numbers as used in the RSA 
cryptography, g is a generator that generates a cyclic group of order n, a is an integer mutually 
prime to n, e is an integer mutually prime to the Euler number of n 9 and S is a constant other 
than 1, 

the generator creating section creates a session-dependent generator g A 
corresponding to a session A, 
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the group signing section sets z = g/ and generates a first proof 



statement 



Vi = SKLOGLOG(z,^,a)[cc:z = g A ^](m) 

proving the knowledge of a satisfying z = g^O 2 ")* and a second proof statement 

V 2 = SKROOTLOG(z*^ 6 ^ 5 e)[P: z*g A B =g A ^](m) 

proving the knowledge of (3 satisfying z*gA = gA^\ 

wherein the anonymous participation data 13 is designated as (A, m, z, 



V u V 2 ). 



11. (Original) The system according to claim 10, wherein 

the anonymous signature determining section checks V\ 9 and V 2 of the 
anonymous participation data to determine whether received data is anonymous participation 
data with anonymous signature authorized by the participant subsystem, and 

the sender match determining section checks z of the anonymous 
participation data to determine whether anonymous signatures of arbitrary two pieces of 
anonymous participation data are signed by an identical participant subsystem. 



12. (Original) The system according to claim 1, wherein the anonymous 
signing section comprises: 

a generator creating section for creating a session-dependent generator 
depending on the session-related information; 

an escrow identifying section for signing the individual data using the 
session-dependent generator and the secret information to produce anonymous participation 
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data, wherein the anonymous participation data includes data obtained by raising the session- 
dependent generator to a power determined by the secret information; and 

a linkage data generating section for generating linkage data indicating 
a relationship among the session-dependent generator and a generator determined by the 
individual data and/or the session-related information. 




'system according to claim 12, wherein the secret information is 
represented bWa, b) th^f satisfies 

b = (a e - 8) 1/e mod n, where n is a product of two prime numbers as used in the RSA 
cryptography, g is a generator that generates a cyclic group of order «, a is an integer mutually 
prime to n, e is an integer mutually prime to the Euler number of n, and 8 is a constant other 
than 1, 

the generator creating section creates a session-dependent generator g A 
corresponding to a session A and a generator g m is generated based on the individual data m 
and/or the session A, 

the escrow identifying section sets z a = gA^ a ^ and generates a first 

proof statement 

V\ = SKROOTLOG(z^,e)[a: z a = gA (a e ) m 

proving the knowledge of a satisfying z a = gA^X and sets z b = gj^^ and generates a 
second proof statement 

V 2 = SKROOTLOG(z, 5 ^,e)[p: z ^^(^)](l) 

proving the knowledge of p satisfying z b = gA^\ and 
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the linkage data generating section sets z c = gS^ and generates a third 

proof statement 

V 3 = SKREP(z c /z a9 g m /g A )[y: zjz a = fe/^) Y ](l) 

proving the knowledge of z a and z c having the same power to the bases g A and g m , 
respectively, 

wherein the anonymous participation data is defined as (A, m, z a , zt» z C9 

V u V 2 , Vi). 



14. (Original) The system according to claim 13, wherein 

the anonymous signature determining section determines whether zjz b 
— gA is satisfied and checks V\ 9 ¥2, and V3 of the anonymous participation data to determine 
whether received data is anonymous participation data with anonymous signature authorized 
by the participant subsystem, and 

the sender match determining section checks one of z a and z b of the 
anonymous participation data to determine whether anonymous signatures of arbitrary two 
pieces of anonymous participation data are signed by an identical participant subsystem. 



15. (Original) The system according to claim 1, wherein the anonymous 
signing section comprises: 

a generator creating section for creating a session-dependent generator 
depending on the session-related information; and 



an escrow identifying section for signing the individual data using the 
session-dependent generator and the secret information to produce anonymous participation 
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data, wherein the anonymous participation data includes data obtained by raising the session- 
dependent generator to a power determined by the secret information. 

16. (Original) The system according to claim 15, wherein the secret 
information is represented by (a, b) that satisfies 

b = (a e - 8) 1/e mod n, where n is a product of two prime numbers as used in the RSA 
cryptography, g is a generator that generates a cyclic group of order n, a is an integer mutually 
prime to «, e is an integer mutually prime to the Euler number of n, and 8 is a constant other 
than 1, 

the generator creating section creates a session-dependent generator gA 
corresponding to a session A, 

the escrow identifying section sets z a = gA^ a ^ and generates a first 

proof statement 

V x = SKROOTLOG(z fl ,^^)[a: z a = g A (^)](m) 

proving the knowledge of a satisfying z a = gA^X and sets z b = g A ^ and generates a 
second proof statement 

V 2 = SKROOTLOG(z^,e)[p: z b = g A (t> e )](m) 

proving the knowledge of p satisfying z b = g A ^\ 

wherein the anonymous participation data is defined as (A, m, z a , z b , V\, 

17. (Original) The system according to claim 16, wherein 
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the anonymous signature determining section determines whether zjzb 
= gA* is satisfied and checks V\ and V2 of the anonymous participation data to determine 
whether received data is anonymous participation data with anonymous signature authorized 
by the participant subsystem, and 

the sender match determining section checks one of z a and zt of the 
anonymous participation data to determine whether anonymous signatures of arbitrary two 
pieces of anonymous participation data are signed by an identical participant subsystem. 

18. (Original) An anonymous participation authority management method for 
a system comprising: 

a participant subsystem that is authorized to anonymously participate in a 
plurality of sessions using secret information; and 

a reception subsystem that determines whether it is acceptable for the 
participant subsystem to participate in a session, 

the method comprising the steps of: 

at the participant subsystem, 

a) authorizing individual data using the secret information depending 
on session-related information to produce anonymous participation data with anonymous 
signature; 

at the reception subsystem, 

b) determining whether received data is anonymous participation data 
with anonymous signature authorized by the participant subsystem; and 

c) determining whether anonymous signatures of arbitrary two pieces 
of anonymous participation data are signed by an identical participant subsystem. 
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19. (Original) The method according to claim 18, wherein the anonymous 
signature includes data that is generated by a predetermined expression using the session- 
related information and the secret information, wherein the step (c) is performed by checking 
the data included in the anonymous signature of received anonymous participation data. 

20. (Original) The method according to claim 19, wherein the predetermined 
expression is represented by raising a session-dependent base to a power that is dependent on 
the secret information. 

21. (Original) The method according to claim 18, wherein the step (a) 
comprises the steps of: 

creating a session-dependent generator depending on the session- 
related information; 

signing the individual data using the session-dependent generator and 
the secret information to produce anonymous participation data, wherein the anonymous 
participation data includes data obtained by raising the session-dependent generator to a 
power determined by the secret information; and 

generating linkage data indicating a relationship among the session- 
dependent generator and a generator determined by the individual data and/or the session- 
related information. 



22. (Original) The method according to claim 18, wherein the step (a) 
comprises the steps of: 
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creating a session-dependent generator depending on the session- 
related information; and 

signing the individual data using the session-dependent generator and 
the secret information to produce anonymous participation data, wherein the anonymous 
participation data includes data obtained by raising the session-dependent generator to a 
power determined by the secret information. 
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